lore-1
A 256-bit key-generation seed caps key recovery in Lore-384 and Lore-512 at 2256 classical, 2128 quantum
Minor break · Argued · Cause: parameter size
Property: key recovery
Cost against claim: secret key from a 256-bit seed: 2256 classical, 2128 quantum, against 384 and 512
Lore derives its whole secret key from one seed, and the submitted scheme draws that seed at 256 bits at every level. The first 32 bytes of the public key are a hash of that seed, so a guess is checked with a single hash call, and the long-term secret key of Lore-384 and Lore-512 is recovered in 2256 classical trials, or about 2128 iterations of Grover's algorithm, whatever the lattice dimension. Those levels ask for 384 and 512 bits classical, 192 and 256 quantum.
| Parameter set | Claim | Attack cost | Verdict |
|---|
| Lore-512 | 512 classical, 256 quantum | 2256 classical; about 2128 Grover iterations | Minor break |
| Lore-384 | 384 classical, 192 quantum | 2256 classical; about 2128 Grover iterations | Minor break |
| Lore-256 | 256 classical, 128 quantum | 2256 classical; about 2128 Grover iterations (no margin) | Holds |
| Lore-128 | 128 classical, 80 quantum | 2256 classical; about 2128 Grover iterations | Holds |
What causes it
Algorithm 7 (PKE KeyGen) draws seed from {0,1}^ρ0, expands it through H_gen into seed_A and seed_sk, and derives the secret s from seed_sk; the specification never fixes ρ0. Section 3.5 states that the 256-bit symmetric primitives serve as temporary references at the 384-bit and 512-bit levels. The reference code (SHAKE and SM3 builds, all four levels) draws a 32-byte seed, hashes it to 64 bytes, publishes the first half as seed_A and expands the second half into s; the test vectors follow the code.
Evidence
PQC-X read the seed path in the reference code at all four levels (one 32-byte seed hashed to 64 bytes, the second half expanded into the secret) and checked at Lore-128 that one flipped bit of the seed changes pk and sk. A second member of PQC-X rebuilt the Lore-128 and Lore-512 test vectors (SHAKE build) from a fresh copy of the unmodified reference code (identical byte for byte after line-ending normalisation), checked that the symmetric code is the same at the four levels and that the SM3 build uses the same widths, ran an instrumented copy at Lore-128 and Lore-512 (one flipped bit of the seed changes pk and sk; changing the implicit-rejection secret z changes neither pk nor the PKE secret), and recomputed with an independent SHAKE256 that the first 32 bytes of pk are the hash of the seed (10,000 wrong seeds never match), so one hash call tests a guess. The secret's own entropy (log2 about 2607 at Lore-384 and 3720 at Lore-512) is far above 256, so the seed is the binding width. No search was run.
Cause in the specification, traced to the specification text.
Limits
Generic, and far out of reach; the fix is a seed and a hash layer sized to the level. The specification leaves the seed length open and presents its 256-bit symmetric layer as temporary; the width entered here is that of the submitted code and test vectors, in both hash variants. The same 256-bit seed meets the 128 level with margin and the 256 level exactly.
Credit
Found by PQC-X.
lore-2
A 256-bit hash of the message and a 256-bit shared key cap Lore-384 and Lore-512 at 2256 classical, 2128 quantum
Minor break · Argued · Cause: parameter size
Property: IND-CCA security
Cost against claim: encapsulated key from (pk, c) alone: 2256 classical, 2128 quantum, against 384 and 512; K is 256 bits where the call asks for at least 384 and 512
The encapsulated key K is 256 bits at every level, while the call requires a key at least as long as the classical level, so Lore-384 and Lore-512 fall short of it. The shortfall is more than a length: the message m is hashed to 256 bits before use, and both (K̄, r) and K derive from that hash, so an attacker holding pk and c guesses the 256-bit hash value, derives r and the part of the ciphertext that depends on r alone, compares it with c, and obtains K̄ and then K. That costs 2256 classical trials, or about 2128 Grover iterations, without the secret key; against the 384 and 512 levels it breaks the claim.
| Parameter set | Claim | Attack cost | Verdict |
|---|
| Lore-512 | 512 classical, 256 quantum; an encapsulated key of at least 512 bits | K is 256 bits; recovered from (pk, c) in 2256 classical, about 2128 Grover iterations | Minor break |
| Lore-384 | 384 classical, 192 quantum; an encapsulated key of at least 384 bits | K is 256 bits; recovered from (pk, c) in 2256 classical, about 2128 Grover iterations | Minor break |
| Lore-256 | 256 classical, 128 quantum; an encapsulated key of at least 256 bits | K is 256 bits; 2256 classical, about 2128 Grover iterations (no margin) | Holds |
What causes it
Algorithm 17 (KEM Encaps) draws m from {0,1}^λ, derives (K̄, r) from G(H(m) || H(pk)), encrypts m under r and sets K = KDF(K̄ || H(c)); the length of K is never stated. Section 3.5 instantiates H, G and KDF with SHAKE256 or SM3 and presents the 256-bit versions as temporary references at the 384-bit and 512-bit levels. In the submitted code (both hash variants, all levels) H has a 256-bit output, K̄ and K are 32 bytes each, and every test-vector file carries a 32-byte shared secret.
Evidence
PQC-X read the widths in the reference code and checked the 32-byte shared secret in all eight test-vector files (SHAKE and SM3, four levels). A second member of PQC-X recomputed K from (m, pk, c) with an independent hash library at Lore-128 and Lore-512 and obtained the shared secret the reference code outputs, which pins the derivation chain, and ran an instrumented copy showing that two different messages encrypted with the same r give the same C_u part of the ciphertext (2304 bytes at Lore-512): C_u depends on r alone, so a guess of H(m) is checked against c without the secret key. No search was run.
Cause in the specification, traced to the specification text.
Limits
Generic, and far out of reach. Three widths cap K at 256 bits (the hash of m, K̄ and K itself), so lengthening K alone would not restore the 384 and 512 levels; the hash layer has to grow with it. The specification presents its 256-bit symmetric layer as temporary. Lore-256 meets its level with these widths, exactly; at Lore-128 the key length requirement is met and the shorter route to K is the 128-bit message itself, treated in a separate observation on this page.
Credit
Found by PQC-X.